Vulnerability??!!

[Scferg]

Um...I was pointed out by somebody that if you type in:
FORUM-DIRECTORY/index.php~ it'll reveal the whole index.php source.

Did I miss something and should have deleted it?

[Scferg]

Well, when I type it in for my forum...it shows the whole code.... like I described

In my forum directory, there's a index.php~ file

[vbgamer45]

It depends on your server configuration and for some configurations it may allow those files to be displayed. This normally is not a security issue unless you have password's or other information that you wish not to share in those files. The ~ are only created if a mod/upgrade package updates those files.

[Scferg]

It is chmodded to 666. And it won't allow me to change the permissions. Should I delete it?

[Scferg]

I'll just back those files up, delete them and see what happens.

[vbgamer45]

I wouldn't delete them then you can't unistall the mods.
It really issn't a security issue unless you have custom code you do not want to share. Since anyone can download a copy of the SMF code.

[Scferg]

Is there any way I could just hide them from the public?

[vbgamer45]

Might want to talk to your host about their configuration if they can block ~ files from being shown or write an htaccess script to deny access to them.

[Scferg]

Ok, thanks!

I was panicked for a bit

[Grudge]

For info you can disable backups from the packages -> options menu if you prefer.

[Scferg]

Ok, thanks

[青山 素子]

If you are on Apache and can use an htaccess file, adding this should stop external access of the files:

Koodi [Valitse] Laajenna


<FilesMatch "\.(php~)$">
Order Allow,Deny
Deny from all
</FilesMatch>


Note I didn't get a chance to test this.

Also, being able to see the source of these backup files isn't a security issue in and of itself. It only becomes an issue if you embed passwords and the like in the SMF source, which is a very bad practice.

[Scferg]

I checked through that whole code for passwords. I know I didn't add anything into that code, but I just wanted to make sure.

[青山 素子]

The only file that SMF uses to store info for database passwords is Settings.php, and it is backed up to Settings_bak.php to prevent the contents from being shown.

As a warning, if you use an editor directly on the shell of the server, some programs will create a similar backup. This means if you edit Settings.php directly on the server, you might encounter an issue. Just remember to check afterwards if you do this.

[Scferg]

Ok -- thanks!